Selective Disclosure

The core principle of selective disclosure is data minimization—revealing only the specific attributes required for a transaction rather than the entire credential. For example, proving you are over 21 without revealing your exact birthdate, address, or full name. This is achieved through cryptographic techniques like BBS+ signatures and Camenisch-Lysyanskaya (CL) signatures that allow a holder to derive a proof over a subset of signed claims while keeping other attributes hidden. The verifier receives only the disclosed claims and a cryptographic proof that the issuer originally signed the complete credential, ensuring both privacy and trust.

Beyond simple attribute revelation, selective disclosure supports predicate proofs—cryptographic assertions about attributes without revealing the attributes themselves. Common predicates include:

• Range proofs: Proving a value falls within a threshold (e.g., salary > $50,000) without disclosing the exact figure.
• Set membership: Proving an attribute belongs to an allowed set (e.g., country of residence is in an approved jurisdiction list).
• Inequality comparisons: Proving two hidden attributes satisfy a relationship (e.g., expiration date > current date). These are implemented using zero-knowledge range proofs like Bulletproofs or accumulator-based membership proofs, enabling complex business logic to be satisfied without raw data exposure.

Advanced selective disclosure schemes provide unlinkability—the property that multiple presentations of the same credential cannot be correlated by the verifier or any external observer. Without this protection, a verifier could track a user across interactions by recognizing the same credential identifier. Techniques ensuring unlinkability include:

• Domain-specific pseudonyms: Deriving a unique, stable identifier per verifier domain without revealing a global identifier.
• Randomized signatures: Cryptographic schemes where each presentation generates a fresh, unlinkable proof even when disclosing the same attributes.
• Verifiable encryption: Allowing a trusted third party to decrypt hidden attributes under specific conditions (e.g., regulatory audit) without breaking unlinkability for normal verifiers.

Selective disclosure extends to compound proofs, where a holder combines claims from multiple distinct verifiable credentials into a single verifiable presentation. For instance, proving eligibility for a service by simultaneously disclosing:

• A citizenship claim from a government-issued ID credential.
• A professional certification from an educational institution credential.
• A credit score threshold from a financial credential. The holder aggregates these disparate claims into one presentation, with each claim individually signed by its respective issuer. The verifier validates all issuer signatures and the logical relationship between claims without the holder needing to reveal any intermediate or linking identifiers across the separate credentials.

Credential schemas define which attributes are mandatory, optional, or conditionally disclosable, providing a structural contract between issuers, holders, and verifiers. Key schema features include:

• Attribute-level granularity: Each field in a credential can be independently marked as selectively disclosable or always-revealed.
• Blinding support: Schema definitions indicate which fields support zero-knowledge hiding vs. plaintext disclosure only.
• Revocation binding: Schemas can require that a revocation check be performed even when the credential identifier itself is hidden, using cryptographic accumulators or bitstring registries. This formalization ensures interoperability across different wallet implementations and verifier systems, as all parties agree on the disclosure capabilities of a credential type before issuance.

Verifiers express their disclosure requirements using presentation exchange policies—declarative JSON documents specifying which claims must be disclosed, which may remain hidden, and what predicate proofs are acceptable. This enables:

• Graduated trust: A verifier can request minimal disclosure for low-risk transactions and escalate to additional claims for high-value operations.
• Fallback logic: If a holder cannot satisfy a predicate proof (e.g., range proof not supported by their wallet), the policy can accept raw attribute disclosure as an alternative.
• Credential selection: Policies can specify acceptable issuer DIDs, credential types, and freshness requirements, allowing the holder's wallet to automatically select the most privacy-preserving credential that satisfies the request.